jQuery cross-site scripting vulnerability (CNVD-2021-28270)

jQuery is the United States John Resig programmer of a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in versions of...

Improper Validation

Overview Affected versions of this package are vulnerable to Improper Validation. Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to...

Design/Logic Flaw

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus, an attacker can exploit this by uploading a .php file to...

CVE-2020-12255

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus, an attacker can exploit this by uploading a .php file to...

Trend Micro Apex One and OfficeScan Directory Traversal (CVE-2020-8599)

A directory traversal vulnerability exists in Trend Micro Apex One and OfficeScan. The vulnerability is due to improper validation of user-supplied file name in the request...

CVE-2020-12022

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed...

Input validation

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed...

CVE-2020-12022

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed...

CVE-2020-12022

CVE-2020-12022 affects Advantech WebAccess Node versions 8.4.4 and prior, and 9.0.0. The vulnerability is an improper validation of array index that could allow an attacker to inject specially crafted input into memory where it can be executed, resulting in remote code execution. Public disclosur...

Advantech WebAccess/SCADA DATACORE IOCTL 0x0000521e Improper Validation of Array Index Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of IOCTL 0x0000521e in DATACORE.exe. The issue results from...

Advantech WebAccess Node

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess Node Vulnerabilities: Improper Validation of Array Index, Relative Path Traversal, SQL Injection, Stack-based Buffer Overflow, Heap-based Buffer Overflow,...

Authentication Bypass

github.com/sourcegraph/sourcegraph is vulnerable to authentication bypass. The vulnerability exists as it improper validates the value of u.Path, causing the SafeRedirectURL method in cmd/frontend/auth/redirect.go to redirect incorrectly...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect. The SourceGraph application has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring. Remediation...

CVE-2020-12283

Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring...

CVE-2020-12283

Sourcegraph before 3.15.1 is affected by an improper validation in the SafeRedirectURL method (cmd/frontend/auth/redirect.go), leading to a vulnerable authentication workflow (example: //foo//example.com). The issue is tied to the authentication redirect logic and can enable an open redirect/auth...

Improper Validation Of Certificate

log4j-core is vulnerable to improper validation of certificate. It does not not verify the host name against the SSL/TLS certificate of an SMTPS connection during the certificate validation, allowing a man-in-the-middle to intercept the log messages sent...

GNU Mailman Cross-Site Scripting Vulnerability

GNU Mailman is a free suite of software from the GNU Project for managing e-mail discussions and e-mail lists. The software can be integrated with Web projects to make it easy for users to manage e-mail subscription accounts and provides built-in archiving, automatic forwarding processing, conten...

Grafana Cross-Site Scripting Vulnerability (CNVD-2020-31592)

Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A cross-site scripting vulnerability exists in Grafana versions prior to 6.7.3. The...

JetBrains Space Chats Cross-Site Scripting Vulnerability

JetBrains Space is a team collaboration solution from the Czech company JetBrains. The product supports online chat, online meetings, code review and package repository, etc. Chats is one of the online chat components. A cross-site scripting vulnerability exists in Chats in JetBrains Space versio...

IBM Spectrum Protect Plus username Command Injection

The IBM Spectrum Protect Plus administrative console running on the remote host is affected by a remote command injection vulnerability due to improper validation of user-supplied data when processing a login HTTP request. An unauthenticated, remote attacker can exploit this, via a specially...